shancheas
6a54aa6c50
- Refactored privilege keys in `api.md` to use a more structured naming convention, aligning with the new `Group.Parent.Module` format. - Updated various module configurations across the application to reflect the new privilege key structure, ensuring consistent access control. - Removed deprecated keys and streamlined the privilege management process, enhancing clarity and maintainability. - Added new tests for privilege key parsing and grouping functionalities to ensure reliability and correctness. These changes significantly improve the application's privilege management system, providing a clearer structure for access control and enhancing overall security.
43 lines
2.1 KiB
Plaintext
43 lines
2.1 KiB
Plaintext
---
|
|
description: RBAC is required for every apps/web product module (menu, moduleKey, action flags)
|
|
globs: apps/web/src/apps/main/**/*.{ts,tsx}
|
|
alwaysApply: false
|
|
---
|
|
|
|
# Web module RBAC
|
|
|
|
Every authenticated product module in `apps/web` must be gated by `GET /auth/me` permissions. Copy Privileges (`system/privileges`) — do not invent a second RBAC path.
|
|
|
|
Catalog keys use `Group.Parent.Module` or `Group.Parent.Module.Submodule` (e.g. `ADMIN.SETTINGS.DATA.BRANCH`, `ADMIN.SALES.ACTIVITIES.ORDER`). `isSuperadmin` bypasses the matrix (adapter returns `defaultPrivileges`).
|
|
|
|
## Required wiring (do all four)
|
|
|
|
1. **`moduleKey`** on `ModuleConfigEntity` equals the Admin catalog `code` (e.g. `ADMIN.SETTINGS.DATA.BRANCH`).
|
|
2. **Menu leaf** in `layouts/data/menu.data.ts` sets the same `moduleKey`. `filterMenuByViewPrivilege` hides the item when `ALLOW_VIEW` is false.
|
|
3. **Routes** wrap in `EnterpriseModuleProvider` so missing `ALLOW_VIEW` shows forbidden (no all-true flash).
|
|
4. **Do not** re-check create/edit/delete in page JSX. Foundations already hide actions from `PrivilegeEntity`.
|
|
|
|
```ts
|
|
// BAD — custom hide/show, or menu without moduleKey
|
|
if (!user.permissions.BRANCHES?.create) return null;
|
|
{ key: 'branches', path: '/app/system/branches/index' }
|
|
|
|
// GOOD
|
|
export const branchesModuleConfig = { moduleKey: 'ADMIN.SETTINGS.DATA.BRANCH', /* ... */ };
|
|
{ key: 'system-branches', path: '/app/system/branches/index', moduleKey: 'ADMIN.SETTINGS.DATA.BRANCH' }
|
|
```
|
|
|
|
## Flag map (`mapUserPrivileges`)
|
|
|
|
| API flag | UI |
|
|
|---|---|
|
|
| `view` | `ALLOW_VIEW` (menu + module chrome) |
|
|
| `create` | `ALLOW_CREATE` (create + duplicate) |
|
|
| `update` | `ALLOW_EDIT` + `ALLOW_ACTIVATE` + `ALLOW_DEACTIVATE` |
|
|
| `delete` | `ALLOW_DELETE` |
|
|
| `import` | `ALLOW_IMPORT` |
|
|
|
|
Missing flag → `false`. Cycles/plans: key follows `purpose` (`ADMIN.SALES.DATA.CYCLE` / `ADMIN.LOGISTICS.ACTIVITIES.PLAN`), not a generic `CYCLES` key.
|
|
|
|
Reference: [apps/web/src/core/lib/map-user-privileges.ts](apps/web/src/core/lib/map-user-privileges.ts), [filter-menu-by-view-privilege.ts](apps/web/src/core/lib/filter-menu-by-view-privilege.ts).
|